What you need to do here is schedule an update task for your client machines: VSE patches are applied via update tasks rather than deployment tasks, which are generally for installing full versions of things.
What you want is an ePO Agent Update Task: when you have created it, make sure you modify its settings to update VSE patches (or alternatively set it to update all products.)
Would this be 'Global Updating' on the Server Settings page?
It currently shows disabled - which makes me wonder how the dats are currently applied! (They are incidentally)
Nope, global updating is a different thing altogether
Check the ePO 3.6 Product Guide - there is a good description of it there.